fix origin header check